Static task
static1
Behavioral task
behavioral1
Sample
a8a5f9f6c7374b76789ffdadd6e91e941fd764e72a41fd714c2b2e9d1bc42d63.exe
Resource
win7-20230712-en
General
-
Target
a8a5f9f6c7374b76789ffdadd6e91e941fd764e72a41fd714c2b2e9d1bc42d63
-
Size
1.3MB
-
MD5
8cd445b6854e28c2b20ce5225846afe3
-
SHA1
5fe8655f5a95e8955c433bafe01ea7da945d56ef
-
SHA256
a8a5f9f6c7374b76789ffdadd6e91e941fd764e72a41fd714c2b2e9d1bc42d63
-
SHA512
92982060d5a9445f800ada943c45b9e34dbcd14a003e688dc0c03be04e8423d0957e2ced26246c3255c7d79b47e678de1727a7511369ed6cb6822cfc08c5790b
-
SSDEEP
24576:2N9iO2UR2f8hyUd8W0HscgL1wVaNqno10LC6aG7XdTaaGF3Osim1BxF0+UJ:2NOUG8KW0Mj1wTo1tu7XdTzGF3Fim1Bu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a8a5f9f6c7374b76789ffdadd6e91e941fd764e72a41fd714c2b2e9d1bc42d63
Files
-
a8a5f9f6c7374b76789ffdadd6e91e941fd764e72a41fd714c2b2e9d1bc42d63.exe windows x86
f5cc6c77869fdee62e732c382ad510d0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTempPathW
CreateFileW
GetCurrentThreadId
CloseHandle
LoadLibraryW
GetLocalTime
GetProcAddress
GetCurrentProcessId
GetFileAttributesW
GetModuleHandleW
LoadLibraryExW
GetCommandLineW
InitializeCriticalSectionAndSpinCount
GetLastError
lstrcatW
DeleteFileW
RaiseException
DecodePointer
LocalFree
MoveFileExW
DeleteCriticalSection
FreeLibrary
MoveFileW
SetUnhandledExceptionFilter
CreateMutexW
WaitForSingleObject
ReleaseMutex
Sleep
OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
QueryDosDeviceW
OpenProcess
FindFirstFileW
GetLongPathNameW
GetFileAttributesExW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
WaitForMultipleObjects
CreateProcessW
GetExitCodeProcess
HeapFree
GetVersionExW
GetComputerNameExW
HeapAlloc
GetProcessHeap
GetModuleFileNameW
FindClose
LockResource
GetSystemInfo
LoadResource
FindResourceW
lstrcmpiW
GetLogicalDriveStringsW
ReadFile
WriteFile
SetFileTime
SetFilePointer
SetEndOfFile
GetFileSize
GetFileTime
CreateDirectoryW
GetFullPathNameW
lstrlenW
SetFileAttributesW
GetCurrentDirectoryW
GetWindowsDirectoryW
GetTempFileNameW
GetFileSizeEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
FormatMessageW
FileTimeToSystemTime
InterlockedExchange
SetLastError
InterlockedExchangeAdd
SetEvent
GetACP
GlobalMemoryStatusEx
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetStdHandle
CreateThread
SwitchToThread
GetCurrentProcess
GetTickCount
ExitThread
FreeLibraryAndExitThread
GetTimeZoneInformation
FindNextFileW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
DeviceIoControl
ResetEvent
CreateEventW
ResumeThread
FindFirstFileExW
GetFileType
GetStringTypeW
EnumSystemLocalesW
GetUserDefaultLCID
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
RtlUnwind
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
user32
SendMessageTimeoutW
wsprintfW
PostMessageW
IsWindow
advapi32
RegCreateKeyExW
shell32
CommandLineToArgvW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetFolderPathW
ole32
CoTaskMemFree
shlwapi
PathRemoveFileSpecW
Sections
.text Size: 1001KB - Virtual size: 1000KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 208KB - Virtual size: 207KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 111KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE